The risk landscape is changing faster than ever

Most internal audit functions still build their plan around an annual risk assessment. The latest Risk in Focus 2026/27 findings indicate that this approach is becoming increasingly difficult to justify. 

The report finds that rapidly evolving, interconnected risks are outpacing strategic decision-making, risk assessment, mitigation, and governance. As a result, annual risk assessments and audit plans can quickly become outdated, and limited internal audit time and resources need to be redirected as risks change. The question for boards and CAEs is therefore not only which risks matter most, but whether internal audit coverage can move as quickly as those risks do. 

The most useful part of the report for internal audit is its comparison of risk rankings with internal audit effort. Cybersecurity is the only area where the two are fully aligned, both ranking first. Outside cybersecurity, risk rankings, and audit effort are less closely aligned: 

These mismatches should be interpreted carefully. Governance may warrant significant audit attention because it affects the management of all other risks. However, the report cautions that as urgent issues dominate board agendas, areas such as human capital and climate change risk may receive less scrutiny despite their continued significance. 

The annual plan is under pressure 

The report shows that many CAEs are already responding. Many have moved away from rigid annual audit plans and now use more frequent risk assessments to drive adaptable schedules, balancing regulatory requirements with urgent business requests. CAEs also report greater collaboration across the organisation, which helps them understand fast-moving risks while preserving internal audit’s independent judgement under the Three Lines Model. 

Agility, however, is not the same as reacting to whichever issue is most urgent. A plan that changes every quarter without clear criteria can be as weak as one that never changes. 

In Malta, particularly outside the regulated financial services sector, second-line functions are often less mature and internal audit teams tend to operate with lean resources. Risk registers may therefore not be updated frequently enough to capture emerging and rapidly changing risks, limiting internal audit’s ability to adapt its plan and assurance coverage at the required pace. Addressing this requires stronger second-line risk management, more dynamic risk registers, and targeted upskilling or co-sourcing to build capability in areas such as AI. Internal audit should also consider how AI can support leaner, more responsive risk assessment and audit delivery, while maintaining appropriate governance and oversight. 

Closing thought 

Risk in Focus 2026/27 shows that internal audit is adapting, but not always at the same pace as the risk landscape. For organisations in Malta, a flexible audit plan is only part of the answer. Timely risk information, an effective second line, and access to the right skills are equally important. The key question for boards and CAEs is not only what internal audit covers, but how quickly it can respond when risks change.